I ask it because I've read IMAP via thunderbird does not support 2FA?

Thunderbird does support 2FA for both, POP and IMAP in connection with OAuth2 authentication, but only for certain email providers. Among them are Gmail, AOL, and Yahoo. There are a few others, which I don't remember.

When you have setup an account with OAuth2 in thunderbird can an external person who knows your emailadres and (first) password also setup an email client w/o OAuth2 and read your mails?

I have read to adapt thunderbird to use your gmail account with 2FA the only thing you have to do is changing the authentication method to oauth2. Does this mean you don't have to add a client-id or application password or token or something else for security?

Does this mean you don't have to add a client-id or application password or token or something else for security?

Correct. You do need a second factor though, typically your phone.